#1110510 security logs not publicly available

Package:
buildd.debian.org
Source:
buildd.debian.org
Submitter:
Uwe Kleine-König
Date:
2025-08-07 07:59:02 UTC
Severity:
normal
#1110510#5
Date:
2025-08-07 07:33:34 UTC
From:
To:
Hello,

I can download the build log of linux 6.1.137-1 for armhf just fine:

	$ getbuildlog linux 6.1.137-1 armhf
	--2025-08-07 09:22:34--  https://buildd.debian.org/status/fetch.php?pkg=linux&arch=armhf&ver=6.1.137-1&stamp=1746668301&raw=1
	Resolving buildd.debian.org (buildd.debian.org)... 2607:f8f0:614:1::1274:60, 209.87.16.60
	Connecting to buildd.debian.org (buildd.debian.org)|2607:f8f0:614:1::1274:60|:443... connected.
	HTTP request sent, awaiting response... 200 OK
	Length: unspecified [text/plain]
	Saving to: ‘linux_6.1.137-1_armhf.log’

	linux_6.1.137-1_armhf.log      [   <=>                                 ] 222.56M  16.8MB/s    in 15s

	2025-08-07 09:22:50 (15.3 MB/s) - ‘linux_6.1.137-1_armhf.log’ saved [233376396]

but it doesn't work for 6.1.140-1:

	$ getbuildlog linux 6.1.140-1 armhf
	$ echo $?
	0

I didn't check how getbuildlog finds the build logs, but I suspect the
failure to find the 6.1.140-1 log relates to this version to be in s-p-u
"only" and
https://buildd.debian.org/status/logs.php?pkg=linux&arch=armhf not
listing it either.

Still it would be great if that worked ...

Best regards
Uwe
--- /etc/devscripts.conf ---
Empty.

--- ~/.devscripts ---
BTS_CACHE=no
DEBCHANGE_RELEASE_HEURISTIC=changelog
DEBSIGN_KEYID=0D2511F322BFAB1C1580266BE2DCDD9132669BD6
DEBCHANGE_MULTIMAINT_MERGE=yes
BTS_SENDMAIL_COMMAND="$HOME/bin/sendmail -t"
#1110510#10
Date:
2025-08-07 07:37:27 UTC
From:
To:
Control: reassign -1 buildd.debian.org

Reassigning to buildd.d.o, given the devscripts tool needs the data
from there.

Chris
#1110510#19
Date:
2025-08-07 07:43:39 UTC
From:
To:
6.1.140-1 isn't 'in s-p-u "only"'. It's a stable-security build,
released for DSA-5925-1.

As such, there are no public logs for the build, so buildd.d.o can't
provide them, and getbuildlog can't fetch them.

Regards,

Adam
#1110510#24
Date:
2025-08-07 07:47:19 UTC
From:
To:
Hi,

I believe that is not really a devscripts problem. 6.1.140-1 was
released via a security update. build logs of security updates are
kept private, and in principle they could be made public after a
package is released if they do not further leak if something is build
from the embargoed queues still embargoed.

This is a longstanding problem and some "recent" discussion started
back in https://lists.debian.org/debian-lts/2023/06/msg00001.html

Regards,
Salvatore
#1110510#29
Date:
2025-08-07 07:50:47 UTC
From:
To:
control: retitle -1 security logs not publicly available

Indeed. At this time we do not have a way to make the build logs
automatically available when a DSA is published. Retitling the bug
accordingly.

Regards
Aurelien